Header Prism

HTTP header & security policy tools

06Access-Control-Allow-*Builder & preflight simulator

CORS header builder

Describe who may call your API and how; get the exact response headers for the preflight and the real request, server code that echoes origins safely, and a simulator that shows what the browser will do.

A

Policy

Allowed origins
Methods
Credentials
B

Response headers

–
Preflight (OPTIONS → 204) 

						Actual response
						

						

							
							
						

					

				

			

		


		

			

				
C
Simulate a browser request

				

					

						

							

								
								
							

							

								
								
							

						

						

							

								
								
							

							

								
								
							

						

						
					

					

				

			

			

				
D
Pitfalls
–

				
    
			
    
		
    

		
    
			
    E
    Server code
    echoes allowed origins only
    
			
    
				
    
					
					
					
					
				
    
				
    
				
    
				
    
			
    
		
    
	
    

	
    
		
    
			
    How CORS decides
    
			
    A browser sends a cross-origin request straight away only if it is “simple”: GET, HEAD or POST with safelisted headers and a form or plain-text body. Anything else, such as JSON bodies, PUT and DELETE or an Authorization header, first triggers an OPTIONS preflight, and the real request is only sent if the preflight's headers allow it.
    
			
      
				
    • One origin per response. Access-Control-Allow-Origin holds a single origin or *. To allow several, compare the request's Origin with your list and echo it, and add Vary: Origin so caches keep the answers apart.
      • 
				
    • Credentials change the rules. With cookies, * is not accepted for the origin and is read literally in the methods and headers lists.
      • 
				
    • CORS is not access control. It only stops other sites reading responses; the request still reaches your server.
      • 
			
    
			
		
    
	
    

	
    
		
    FAQ
    CORS questions
    
		
    
			
    
				Why does my request work in curl but fail in the browser?
				
    curl ignores CORS. Browsers enforce it on behalf of the user, and block a page from reading the response when the Access-Control headers are missing or do not match.
    
			
    
			
    
				Can I use a wildcard like https://*.example.com?
				
    No, browsers do not understand wildcards inside an origin. Match subdomains on the server with an exact, anchored check and echo the matching origin.
    
			
    
			
    
				Do I need OPTIONS routes in my app?
				
    Something must answer the preflight with a 2xx status and the Access-Control headers before your auth middleware rejects it. The snippets return 204 for OPTIONS.